Privacy Policy

Updated2 September 2026

DeskStack respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store and share personal information when you visit the DeskStack website, create an account, purchase equipment, apply to rent equipment, enter into a rental agreement, provide a personal guarantee, contact us or otherwise interact with DeskStack.

It also explains your rights under UK data protection law.

01Who we are

DeskStack is a trading name and brand operated by:

Cave Direct Technology Ltd

Company number: 14899593

Registered office: StorageMart, Unit 1618 Vulcan Road North, Norwich, England, NR6 6AQ

In this Privacy Policy, references to “DeskStack”, “we”, “us” or “our” mean Cave Direct Technology Ltd trading as DeskStack.

For the purposes of UK data protection law, Cave Direct Technology Ltd is generally the data controller of the personal information described in this policy.

You can contact us about privacy or data protection matters using the contact details published on the DeskStack website or by emailing:

hello@deskstack.co.uk

02Who this policy applies to

This Privacy Policy may apply to:

visitors to the DeskStack website;

customers purchasing equipment;

businesses applying to rent equipment;

directors and owners of applicant businesses;

sole traders;

employees or representatives of business customers;

authorised users of rented equipment;

individuals providing personal guarantees;

people contacting our support team;

suppliers and business contacts; and

prospective customers.

DeskStack's rental services are primarily intended for business customers.

Information relating solely to a limited company is not necessarily personal information. However, information identifying directors, employees, guarantors, sole traders or other identifiable individuals is personal information and is covered by this policy.

03Personal information we may collect

Depending on how you interact with DeskStack, we may collect the following information.

Identity information

This may include:

full name;

title;

date of birth where required;

job title or role;

director or business owner status; and

other information required to confirm your identity.

Contact information

This may include:

business email address;

personal email address where supplied;

telephone number;

billing address;

delivery address;

business address; and

other contact details.

Business information

This may include:

company name;

company registration number;

VAT number;

registered office;

trading address;

incorporation date;

company status;

directors;

persons with significant control;

business type;

trading history;

website;

business contact details; and

other information relevant to assessing a business rental application.

Some of this information may be obtained from publicly available sources such as Companies House.

04Identity and verification documents

For some rental applications, particularly where a business is newly incorporated or where additional verification is reasonably required, we may ask for documents such as:

passport;

driving licence;

proof of address;

utility bill;

bank statement;

business bank statement;

other identity documents; or

other documents reasonably required to confirm identity, address or eligibility.

We aim to collect only the information reasonably required for the relevant verification.

Documents supplied for verification may contain information that is not relevant to our checks. Where appropriate, customers may be permitted or encouraged to obscure information that we do not need.

We do not collect identity documents simply because they are available. We will only request them where we consider additional verification appropriate.

05Financial and payment information

We may process information relating to payments, including:

billing details;

payment status;

payment history;

failed payments;

refunds;

deposits;

amounts due;

invoices;

rental payment history;

payment processor references; and

limited information associated with the payment method.

Card payments are processed by third-party payment providers such as Stripe.

DeskStack does not need to store your complete payment-card number or card security code within our own systems when payment is handled by our payment processor.

Our payment provider may process additional information under its own privacy terms.

06Rental application and eligibility information

Where you apply to rent equipment, we may collect and generate information to help us decide whether we can offer a rental arrangement.

This may include:

incorporation date;

length of trading history;

company status;

directors and persons with significant control;

financial information supplied by you;

information from public registers;

identity-verification results;

address-verification results;

payment information;

previous dealings with DeskStack;

rental value requested;

equipment requested;

risk indicators;

application notes;

approval or decline decisions;

deposit requirements;

personal-guarantee requirements; and

other information reasonably relevant to assessing the application.

We may also use information provided by credit-reference, identity-verification or fraud-prevention providers where we use such services.

07Personal guarantees

Where DeskStack requires a personal guarantee, we may process personal information about the guarantor including:

name;

address;

contact details;

date of birth where required;

identity information;

proof of identity;

proof of address;

relationship to the business;

details of the guarantee;

electronic signature;

date and time of signature; and

information required to enforce or administer the guarantee.

A personal guarantee creates obligations for the individual providing it, so we may need to retain appropriate records relating to the guarantee after the rental itself has ended.

08Purchase and rental information

We may process information concerning:

products purchased;

equipment rented;

rental packages;

monthly rental amounts;

serial numbers and asset identifiers;

start and end dates;

rental agreements;

orders;

delivery details;

returns;

replacement equipment;

upgrades;

faults;

repairs;

equipment condition;

loss or damage;

non-returned equipment;

cancelled orders; and

correspondence relating to the order or rental.

09Electronic signatures and agreements

Where you electronically sign a DeskStack agreement, we may retain information including:

your name;

the agreement;

signature;

date and time of signing;

account details associated with the agreement;

IP address or technical records associated with signing where collected; and

an audit history showing when the agreement was created, viewed, accepted or signed.

We retain these records so that we can administer the agreement and demonstrate what was agreed between the parties.

10Communications

If you contact us, we may retain information including:

emails;

contact-form submissions;

telephone notes;

support enquiries;

complaints;

live-chat messages where applicable;

correspondence concerning applications;

correspondence concerning payments;

correspondence concerning damaged or missing equipment; and

other communications with DeskStack.

11Website and technical information

When you use our website, we may automatically collect technical information including:

IP address;

browser type;

operating system;

device type;

approximate geographic location;

pages viewed;

referring website;

time and date of visits;

interactions with our website;

session information; and

cookie or similar technology identifiers.

We may use analytics and website-monitoring tools to understand how visitors use DeskStack and to identify technical problems.

Where analytics services such as Google Analytics, Microsoft Clarity or similar services are enabled, those providers may also process information in accordance with their own privacy terms.

12Where we obtain information from

Most personal information is provided directly by you.

We may also obtain information from:

Companies House;

other public registers;

your employer or business;

directors or representatives of your organisation;

payment providers;

identity-verification providers;

credit-reference providers where used;

fraud-prevention services;

delivery companies;

publicly accessible business websites;

professional advisers;

debt-recovery providers;

our existing business records; and

other lawful sources.

Where we obtain personal information from public sources, that information remains subject to data protection law when we process it.

13Why we use your information

We may process personal information for the following purposes:

providing the DeskStack website;

creating and administering accounts;

responding to enquiries;

providing quotations;

processing purchases;

considering rental applications;

confirming the identity of applicants and guarantors;

assessing rental eligibility;

preventing fraud;

checking company information;

preparing rental agreements;

administering personal guarantees;

taking and managing payments;

collecting deposits;

delivering equipment;

managing rental equipment;

providing replacement equipment;

providing customer support;

handling faults, returns and repairs;

recovering unpaid amounts or equipment;

protecting DeskStack's assets;

maintaining financial and accounting records;

complying with legal and regulatory requirements;

establishing, exercising or defending legal claims;

improving our products, website and services;

monitoring website security;

detecting misuse or attempted attacks;

measuring website performance;

carrying out appropriate business-to-business marketing; and

sending marketing communications where legally permitted.

14Our lawful bases for processing

UK data protection law requires us to have a lawful basis for processing personal information.

Depending on the circumstances, we may rely on:

Contract

We may process information where this is necessary to enter into or perform a contract with you.

This may apply particularly to sole traders and individuals entering into personal guarantees or other agreements directly with us.

Legitimate interests

Because many DeskStack contracts are with limited companies rather than with the individual employee or director dealing with us, much of our business processing is carried out on the basis of our legitimate interests.

Our legitimate interests may include:

operating a business-equipment rental service;

assessing whether a business is suitable for rental;

verifying who we are dealing with;

preventing fraud;

protecting our equipment;

administering customer relationships;

managing payments;

recovering debts;

recovering rental equipment;

maintaining business records;

improving our services;

securing our website and systems; and

appropriate business-to-business marketing.

Where we rely on legitimate interests, we consider whether our interests are proportionate and whether they are overridden by the rights and interests of the individual concerned.

Legal obligation

We may process information where necessary to comply with legal obligations, including taxation, accounting, court orders and other applicable legal requirements.

Consent

Where required, we may rely on your consent, particularly for certain marketing communications or non-essential cookies.

Where processing is based on consent, you can normally withdraw that consent at any time.

The ICO confirms that organisations must identify an appropriate lawful basis before processing personal information and that legitimate interests may be used where the use is proportionate, expected and does not improperly override an individual's interests.

15Rental eligibility and risk assessment

DeskStack takes reasonable steps to protect rental equipment and reduce the risk of fraud, non-payment and non-return.

We may therefore assess information such as:

age of the business;

company status;

directors;

trading history;

requested monthly rental value;

existing rental exposure;

payment history;

verification information;

information provided with your application;

publicly available information; and

other relevant risk factors.

The outcome may affect whether we:

approve an application;

request more information;

limit the value or quantity of equipment;

request a deposit;

require a personal guarantee; or

decline to provide rental equipment.

16Automated decision-making

DeskStack may use automated rules to assist with application processing.

For example, our system may identify that a recently incorporated business requires additional documents or a personal guarantee.

However, we do not intend to rely solely on automated processing to make decisions that produce legal or similarly significant effects on individuals without appropriate human involvement unless we specifically tell you otherwise.

Automated rules may instead flag an application for further review by DeskStack.

17Credit and fraud checks

Where appropriate, we may use third-party services to assist with:

company verification;

identity verification;

credit assessment;

fraud prevention;

address verification; or

payment-risk assessment.

Those providers may process personal information in accordance with their own privacy notices.

If we introduce a credit-reference or identity provider whose use requires additional information to be given to you, we will provide that information as appropriate.

18How we share information

We do not sell your personal information.

We may share information where reasonably necessary with:

website and hosting providers;

IT and cloud-service providers;

payment processors;

banks and financial institutions;

accountants and bookkeepers;

delivery and courier companies;

identity-verification providers;

credit-reference or fraud-prevention providers;

email and communications providers;

analytics providers;

insurers;

suppliers involved in fulfilling an order;

professional advisers;

solicitors;

courts;

debt-recovery providers;

enforcement agents where lawfully instructed;

law-enforcement agencies;

regulators;

government bodies;

tax authorities; and

other organisations where required or permitted by law.

We require organisations processing personal information on our behalf to handle that information appropriately.

19Debt recovery and recovery of equipment

Where a customer does not make payments when due, fails to return rental equipment or otherwise breaches a rental agreement, we may use relevant personal information to:

contact the customer;

contact a guarantor;

investigate the matter;

trace equipment;

establish the location of the customer where lawful;

recover unpaid amounts;

recover our property;

refer the matter to professional advisers;

use debt-recovery services;

commence legal proceedings;

enforce a judgment; or

report suspected criminal activity where appropriate.

Information may therefore be disclosed to solicitors, debt-recovery providers, courts, enforcement agents, fraud-prevention services or law-enforcement authorities where reasonably necessary and lawful.

20Fraud and crime prevention

We may process and disclose information where reasonably necessary to prevent, detect or investigate fraud, theft or other unlawful activity.

For example, this may be necessary where:

false information has been supplied during an application;

identity documents appear fraudulent;

equipment is deliberately not returned;

rental equipment is believed to have been stolen;

payment fraud is suspected; or

we are required to assist a lawful investigation.

We will only process information for these purposes where there is an appropriate lawful basis.

21Marketing

We may send information about DeskStack products and services where permitted by law.

You can ask us to stop sending direct marketing at any time.

Marketing emails will normally contain an unsubscribe option where appropriate.

Where consent is required for electronic marketing, we will obtain appropriate consent.

Where the law permits us to rely on legitimate interests for appropriate business-to-business marketing, we may do so, but you retain the right to object to the use of your personal information for direct marketing.

The right to object to processing for direct marketing is absolute.

Electronic marketing is also subject to the Privacy and Electronic Communications Regulations. The ICO requires appropriate consent where PECR requires it and sets specific conditions for use of the customer “soft opt-in”.

22Cookies

DeskStack uses cookies and similar technologies.

Some cookies are necessary for the website to function, for example to:

keep users signed in;

maintain security;

operate the shopping basket;

maintain checkout sessions; or

remember necessary session information.

We may also use optional cookies for purposes such as:

analytics;

measuring website performance;

understanding visitor behaviour; and

improving our marketing.

Where consent is required for non-essential cookies, we will not intentionally place those cookies until the appropriate consent has been obtained.

The ICO's current guidance distinguishes strictly necessary cookies from non-essential cookies and requires an appropriate consent mechanism for non-essential cookies.

You can manage your cookie choices through the controls provided on our website where available.

23How long we retain information

We do not intend to keep personal information for longer than reasonably necessary.

The appropriate retention period depends on why the information was collected.

Customer, order and rental records

We may generally retain contractual, transaction and rental records for up to six years after the relevant customer relationship or agreement ends, where appropriate for accounting, taxation, disputes, legal claims and record keeping.

Rental applications

Where an application results in a rental relationship, relevant application and decision records may form part of the customer record.

Where an application is declined, withdrawn or abandoned, we will normally retain the application information only for an appropriate limited period, which will generally not exceed 12 months, unless there is a legitimate reason to retain it for longer.

Raw identity documents

Copies of passports, driving licences and similar identity-verification documents present a higher privacy risk than ordinary business information.

Where possible, we aim to retain the verification outcome rather than the original document itself.

Unless an original document is still reasonably required for a fraud investigation, dispute, legal claim or other justified reason, we aim to delete raw identity-document copies within approximately 90 days after verification or completion of the relevant application process.

Proof-of-address and supporting financial documents

Documents such as bank statements or utility bills supplied solely for verification will normally be deleted once they are no longer reasonably required for that purpose.

We may retain a record confirming that verification was completed without retaining the complete source document.

Agreements and guarantees

Rental agreements, personal guarantees and records demonstrating their acceptance may be retained for up to six years after the relevant agreement or obligation ends, or longer where reasonably required because of an ongoing dispute or legal claim.

Financial records

Information that must be retained for accounting or taxation purposes will be retained for the period required by applicable law.

Marketing records

We may retain basic suppression information after somebody unsubscribes so that we can ensure that we respect their preference and do not inadvertently add them back to marketing lists.

Website analytics

Analytics and technical information will be kept for a period proportionate to its purpose and the settings of the relevant analytics services.

We periodically review the personal information we retain and delete or anonymise information that is no longer required.

24How we protect personal information

We take reasonable technical and organisational measures to protect personal information from:

unauthorised access;

accidental loss;

misuse;

alteration;

disclosure;

destruction; and

cyber-security threats.

Measures may include, where appropriate:

access controls;

authentication;

secure hosting;

encryption;

restricted administrative access;

software updates;

backups;

logging;

staff access controls; and

procedures for responding to security incidents.

UK GDPR requires organisations to implement security measures appropriate to the nature of the information and the risks involved.

No internet-connected system can be guaranteed to be completely secure, but we take reasonable steps appropriate to our business and the information we process.

25Personal data breaches

If we become aware of a personal-data breach, we will investigate it and take appropriate action.

Where required by law, we will notify the Information Commissioner's Office and/or affected individuals.

We maintain procedures intended to identify and respond to significant security incidents.

26International transfers

Some of the service providers we use may process information outside the United Kingdom.

Where personal information is transferred internationally, we will take appropriate steps to ensure that the transfer is permitted under UK data protection law.

Depending on the destination and provider, this may include:

UK adequacy regulations;

recognised data-transfer arrangements;

contractual safeguards; or

another legally permitted transfer mechanism.

The ICO maintains current guidance on the safeguards applicable to international transfers, including UK adequacy arrangements.

27Your data protection rights

Depending on the circumstances, UK data protection law gives you rights including:

Right to be informed

You have the right to receive information about how your personal information is processed.

Right of access

You may request a copy of personal information that we hold about you.

Right to rectification

You may ask us to correct personal information that is inaccurate or incomplete.

Right to erasure

In certain circumstances, you may ask us to delete personal information.

This is not an absolute right. For example, we may need to retain information to comply with law, administer an agreement, recover money or equipment, or establish or defend legal claims.

Right to restriction

In certain circumstances, you may ask us to restrict the way in which we use your personal information.

Right to data portability

Where applicable, you may have the right to receive certain information in a structured, commonly used and machine-readable format.

Right to object

You may have the right to object to certain processing based on legitimate interests.

You have an absolute right to object to the processing of your personal information for direct marketing.

Rights relating to automated decision-making

You may have rights concerning decisions based solely on automated processing where those decisions have legal or similarly significant effects.

These rights are subject to conditions and exemptions under applicable law. The ICO confirms rights including rectification, restriction and objection under the UK GDPR.

28Exercising your rights

To exercise your rights, contact us at:

hello@deskstack.co.uk

Please clearly explain what you are requesting.

We may need to ask for information to verify your identity before responding to a request. This is intended to prevent personal information from being disclosed to somebody who is not entitled to receive it.

We will respond within the timescales required by applicable data protection law.

29Complaints

If you have concerns about how DeskStack has handled your personal information, we would encourage you to contact us first so that we have an opportunity to investigate and resolve the matter.

You also have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO)

You do not have to contact us before making a complaint to the ICO.

30Children

DeskStack is a business-focused service and is not intended for children.

We do not knowingly offer rental agreements to individuals under the age of 18 or intentionally collect personal information from children through our business rental process.

If we become aware that personal information relating to a child has been collected unnecessarily, we will take appropriate steps to delete it.

31Special category information

DeskStack does not generally need or seek sensitive information concerning matters such as health, religion, ethnicity, political opinions or sexual orientation.

Please do not provide this type of information unless it is genuinely necessary and we have requested it.

Identity documents may incidentally contain information beyond what we need. We will not intentionally use incidental information for unrelated purposes.

If we ever need to process special-category personal information, we will only do so where the additional requirements of data protection law are satisfied.

32Changes of business ownership

If DeskStack, its business, assets or rental portfolio are sold, transferred, reorganised or moved to another corporate entity, relevant customer information may need to be transferred as part of that transaction.

Any such transfer will be handled in accordance with applicable data protection law.

Where appropriate, affected customers will be informed of a change in the identity of the data controller.

33Third-party websites

Our website may contain links to websites or services operated by other organisations.

DeskStack is not responsible for the privacy practices of independent third-party websites.

You should review the privacy information provided by those organisations when providing information directly to them.

34Keeping your information accurate

Please let us know if important personal or business information changes during your relationship with DeskStack.

You may also be able to update certain information through your DeskStack account.

Accurate contact and delivery information is particularly important for rental customers because we need to be able to communicate with you about payments, equipment, replacements, renewals and returns.

35Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

changes to our services;

changes to how we process information;

new technology;

new service providers;

changes to applicable law; or

regulatory guidance.

The latest version will be published on the DeskStack website and will show the date on which it was last updated.

Where a change materially affects how we use existing personal information, we will take reasonable steps to bring the change to the attention of affected individuals where required.

36Contact us

Questions about this Privacy Policy or the way DeskStack processes personal information can be sent to:

DeskStack

Cave Direct Technology Ltd

Company number 14899593

StorageMart, Unit 1618 Vulcan Road North

Norwich

England

NR6 6AQ

Email: hello@deskstack.co.uk